AIKIDO-2026-288031

TL;DR

Gem::Source#fetch_spec builds the on-disk spec cache path directly from the spec name in a name tuple returned by a remote gem index, without validating that name as a path component. A crafted spec name containing path separators or .. causes the downloaded gemspec bytes to be written outside Gem.spec_cache_dir, before the Marshal payload is ever loaded. A malicious or compromised gem source can therefore trigger an arbitrary file write on the client with an attacker-controlled path and content. The fix rejects any spec name whose File.basename differs from the full value before the cache path is constructed.